From chris@bigballofwax.co.nz Fri Jul 10 01:23:08 2026 From: Chris Cormack To: koha-devel@lists.koha-community.org Subject: [Koha-devel] Re: [Koha] HTML not being encoded for display? Date: Fri, 07 Mar 2008 12:07:40 +1300 Message-ID: <606aab810803061507r50b797efo5294e445b6d08e49@mail.gmail.com> In-Reply-To: <003d01c87fdc$f5a12310$69207890@library.usp.ac.fj> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============5969368737164793732==" --===============5969368737164793732== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Shifting this over the devel lists, where it can be discussed more fully. Chris On 3/7/08, Chris Hammond-Thrasher wrote: > > This could be a serious problem. Is this addressed in Koha 3? Are their > any > checks for dangerous user input in Koha 2 or 3? > > -cht > > > > Chris Hammond-Thrasher MLIS CISSP > Library Systems Manager > University of the South Pacific > Suva, Fiji > +679 3232233 > hammondthrasher_c@usp.ac.fj > > > -----Original Message----- > From: koha-bounces@lists.katipo.co.nz > [mailto:koha-bounces@lists.katipo.co.nz] On Behalf Of Rick Welykochy > Sent: Thursday, 6 March 2008 12:39 PM > To: George Adams > Cc: koha@lists.katipo.co.nz > Subject: Re: [Koha] HTML not being encoded for display? > > > George Adams wrote: > > > For example, in the "Add a MARC Record" section, I can enter in a title > (tag 245c) of the following: > > > > My Book is Great > > > > Sure enough, when the completed MARC record is submitted, the additem.pl > page will show the title with the word "Great" really big. Once added to > the catalog, it will show up in the search engines with that word really > big > as well. > > > > Surely everything entered by users and librarian in the OPAC and > Intranet > sites should be HTML-encoded if it's going to be redisplayed, right? Did > I > miss some setting in the Administration menus that would disallow HTML > from > being entered in a form, or is this a fairly big bug? > > > This is why Koha is susceptible to cross-site scripting attacks, as > already > raised by someone else on this list a few months back. > > Example: > > My book is > > > cheers > rickw > > > > -- > ________________________________________________________________ > Rick Welykochy || Praxis Services || Internet Driving Instructor > > A terrorist is someone who has a bomb but can't afford an air force. > -- William Blum > _______________________________________________ > Koha mailing list > Koha@lists.katipo.co.nz > http://lists.katipo.co.nz/mailman/listinfo/koha > > _______________________________________________ > Koha mailing list > Koha@lists.katipo.co.nz > http://lists.katipo.co.nz/mailman/listinfo/koha > --===============5969368737164793732== Content-Type: text/html Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" MIME-Version: 1.0 U2hpZnRpbmcgdGhpcyBvdmVyIHRoZSBkZXZlbCBsaXN0cywgd2hlcmUgaXQgY2FuIGJlIGRpc2N1 c3NlZCBtb3JlIGZ1bGx5Ljxicj48YnI+Q2hyaXM8YnI+PGJyPjxkaXY+PHNwYW4gY2xhc3M9Imdt YWlsX3F1b3RlIj5PbiAzLzcvMDgsIDxiIGNsYXNzPSJnbWFpbF9zZW5kZXJuYW1lIj5DaHJpcyBI YW1tb25kLVRocmFzaGVyPC9iPiAmbHQ7PGEgaHJlZj0ibWFpbHRvOmhhbW1vbmR0aHJhc2hlcl9j QHVzcC5hYy5maiI+aGFtbW9uZHRocmFzaGVyX2NAdXNwLmFjLmZqPC9hPiZndDsgd3JvdGU6PC9z cGFuPjxibG9ja3F1b3RlIGNsYXNzPSJnbWFpbF9xdW90ZSIgc3R5bGU9ImJvcmRlci1sZWZ0OiAx cHggc29saWQgcmdiKDIwNCwgMjA0LCAyMDQpOyBtYXJnaW46IDBwdCAwcHQgMHB0IDAuOGV4OyBw YWRkaW5nLWxlZnQ6IDFleDsiPgpUaGlzIGNvdWxkIGJlIGEgc2VyaW91cyBwcm9ibGVtLiBJcyB0 aGlzIGFkZHJlc3NlZCBpbiBLb2hhIDM/IEFyZSB0aGVpciBhbnk8YnI+IGNoZWNrcyBmb3IgZGFu Z2Vyb3VzIHVzZXIgaW5wdXQgaW4gS29oYSAyIG9yIDM/PGJyPiA8YnI+IC1jaHQ8YnI+IDxicj48 YnI+IDxicj4gQ2hyaXMgSGFtbW9uZC1UaHJhc2hlciZuYnNwOyZuYnNwO01MSVMgQ0lTU1A8YnI+ IExpYnJhcnkgU3lzdGVtcyBNYW5hZ2VyPGJyPgogVW5pdmVyc2l0eSBvZiB0aGUgU291dGggUGFj aWZpYzxicj4gU3V2YSwgRmlqaTxicj4gKzY3OSAzMjMyMjMzPGJyPiA8YSBocmVmPSJtYWlsdG86 aGFtbW9uZHRocmFzaGVyX2NAdXNwLmFjLmZqIj5oYW1tb25kdGhyYXNoZXJfY0B1c3AuYWMuZmo8 L2E+PGJyPiA8YnI+PGJyPiAtLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLTxicj4gRnJvbTogPGEg aHJlZj0ibWFpbHRvOmtvaGEtYm91bmNlc0BsaXN0cy5rYXRpcG8uY28ubnoiPmtvaGEtYm91bmNl c0BsaXN0cy5rYXRpcG8uY28ubno8L2E+PGJyPgogW21haWx0bzo8YSBocmVmPSJtYWlsdG86a29o YS1ib3VuY2VzQGxpc3RzLmthdGlwby5jby5ueiI+a29oYS1ib3VuY2VzQGxpc3RzLmthdGlwby5j by5uejwvYT5dIE9uIEJlaGFsZiBPZiBSaWNrIFdlbHlrb2NoeTxicj4gU2VudDogVGh1cnNkYXks IDYgTWFyY2ggMjAwOCAxMjozOSBQTTxicj4gVG86IEdlb3JnZSBBZGFtczxicj4gQ2M6IDxhIGhy ZWY9Im1haWx0bzprb2hhQGxpc3RzLmthdGlwby5jby5ueiI+a29oYUBsaXN0cy5rYXRpcG8uY28u bno8L2E+PGJyPgogU3ViamVjdDogUmU6IFtLb2hhXSBIVE1MIG5vdCBiZWluZyBlbmNvZGVkIGZv ciBkaXNwbGF5Pzxicj4gPGJyPiA8YnI+R2VvcmdlIEFkYW1zIHdyb3RlOjxicj4gPGJyPiAmZ3Q7 IEZvciBleGFtcGxlLCBpbiB0aGUgJnF1b3Q7QWRkIGEgTUFSQyBSZWNvcmQmcXVvdDsgc2VjdGlv biwgSSBjYW4gZW50ZXIgaW4gYSB0aXRsZTxicj4gKHRhZyAyNDVjKSBvZiB0aGUgZm9sbG93aW5n Ojxicj4KICZndDs8YnI+ICZndDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDtNeSBCb29rIGlzICZs dDtmb250IHNpemU9JnF1b3Q7KzUmcXVvdDsmZ3Q7R3JlYXQmbHQ7L2ZvbnQmZ3Q7PGJyPiAmZ3Q7 PGJyPiAmZ3Q7IFN1cmUgZW5vdWdoLCB3aGVuIHRoZSBjb21wbGV0ZWQgTUFSQyByZWNvcmQgaXMg c3VibWl0dGVkLCB0aGUgYWRkaXRlbS5wbDxicj4gcGFnZSB3aWxsIHNob3cgdGhlIHRpdGxlIHdp dGggdGhlIHdvcmQgJnF1b3Q7R3JlYXQmcXVvdDsgcmVhbGx5IGJpZy4mbmJzcDsmbmJzcDtPbmNl IGFkZGVkIHRvPGJyPgogdGhlIGNhdGFsb2csIGl0IHdpbGwgc2hvdyB1cCBpbiB0aGUgc2VhcmNo IGVuZ2luZXMgd2l0aCB0aGF0IHdvcmQgcmVhbGx5IGJpZzxicj4gYXMgd2VsbC48YnI+ICZndDs8 YnI+ICZndDsgU3VyZWx5IGV2ZXJ5dGhpbmcgZW50ZXJlZCBieSB1c2VycyBhbmQgbGlicmFyaWFu IGluIHRoZSBPUEFDIGFuZCBJbnRyYW5ldDxicj4gc2l0ZXMgc2hvdWxkIGJlIEhUTUwtZW5jb2Rl ZCBpZiBpdCYjMzk7cyBnb2luZyB0byBiZSByZWRpc3BsYXllZCwgcmlnaHQ/Jm5ic3A7Jm5ic3A7 RGlkIEk8YnI+CiBtaXNzIHNvbWUgc2V0dGluZyBpbiB0aGUgQWRtaW5pc3RyYXRpb24gbWVudXMg dGhhdCB3b3VsZCBkaXNhbGxvdyBIVE1MIGZyb208YnI+IGJlaW5nIGVudGVyZWQgaW4gYSBmb3Jt LCBvciBpcyB0aGlzIGEgZmFpcmx5IGJpZyBidWc/PGJyPiA8YnI+IDxicj4gVGhpcyBpcyB3aHkg S29oYSBpcyBzdXNjZXB0aWJsZSB0byBjcm9zcy1zaXRlIHNjcmlwdGluZyBhdHRhY2tzLCBhcyBh bHJlYWR5PGJyPgogcmFpc2VkIGJ5IHNvbWVvbmUgZWxzZSBvbiB0aGlzIGxpc3QgYSBmZXcgbW9u dGhzIGJhY2suPGJyPiA8YnI+IEV4YW1wbGU6PGJyPiA8YnI+IE15IGJvb2sgaXMgJmx0O3Njcmlw dCZndDthbGVydCgmcXVvdDtHb3RjaGEhJnF1b3Q7KSZsdDsvc2NyaXB0Jmd0Ozxicj4gPGJyPiA8 YnI+IGNoZWVyczxicj4gcmlja3c8YnI+IDxicj4gPGJyPiA8YnI+IC0tPGJyPiBfX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPGJy PgogUmljayBXZWx5a29jaHkgfHwgUHJheGlzIFNlcnZpY2VzIHx8IEludGVybmV0IERyaXZpbmcg SW5zdHJ1Y3Rvcjxicj4gPGJyPiBBIHRlcnJvcmlzdCBpcyBzb21lb25lIHdobyBoYXMgYSBib21i IGJ1dCBjYW4mIzM5O3QgYWZmb3JkIGFuIGFpciBmb3JjZS48YnI+Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7LS0gV2lsbGlhbSBCbHVtPGJyPiBfX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fXzxicj4KIEtvaGEgbWFpbGluZyBsaXN0PGJyPiA8 YSBocmVmPSJtYWlsdG86S29oYUBsaXN0cy5rYXRpcG8uY28ubnoiPktvaGFAbGlzdHMua2F0aXBv LmNvLm56PC9hPjxicj4gPGEgaHJlZj0iaHR0cDovL2xpc3RzLmthdGlwby5jby5uei9tYWlsbWFu L2xpc3RpbmZvL2tvaGEiPmh0dHA6Ly9saXN0cy5rYXRpcG8uY28ubnovbWFpbG1hbi9saXN0aW5m by9rb2hhPC9hPjxicj4gPGJyPiBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fXzxicj4KIEtvaGEgbWFpbGluZyBsaXN0PGJyPiA8YSBocmVmPSJtYWlsdG86S29o YUBsaXN0cy5rYXRpcG8uY28ubnoiPktvaGFAbGlzdHMua2F0aXBvLmNvLm56PC9hPjxicj4gPGEg aHJlZj0iaHR0cDovL2xpc3RzLmthdGlwby5jby5uei9tYWlsbWFuL2xpc3RpbmZvL2tvaGEiPmh0 dHA6Ly9saXN0cy5rYXRpcG8uY28ubnovbWFpbG1hbi9saXN0aW5mby9rb2hhPC9hPjxicj4gPC9i bG9ja3F1b3RlPgo8L2Rpdj48YnI+Cg== --===============5969368737164793732==--